Purpose
Scan transaction and account data against established FATF and FinCEN red flag typologies to surface suspicious activity indicators, rank them by severity, and produce a SAR-readiness assessment — turning raw transaction review into a structured, defensible investigation record.
When to Use
Invoke this skill when the user asks to:
- Review a customer's transaction history for suspicious patterns
- Triage or investigate a monitoring system alert (structuring, velocity, geographic risk)
- Screen virtual asset transfers for mixing, chain-hopping, or peel chain behavior
- Assess whether observed activity meets the threshold for a SAR filing
- Identify which FATF or FinCEN typology a given behavior maps to
- Prepare the factual basis for a SAR narrative from transaction data
Inputs Required
Before starting, collect:
- Transaction data: Dates, amounts, direction, counterparties, and instrument type (fiat wire, ACH, on-chain transfer, card, cash)
- Account context: Account type, customer risk rating, KYC/CDD profile, expected activity, account age
- Customer profile: Occupation/business type, stated source of funds, jurisdiction of residence
- Institution type: Crypto firm / broker-dealer / bank / MSB (determines applicable typologies)
- Time window: The review period being examined
- Prior alerts or filings: Any earlier SARs, CTRs, or dispositioned alerts on this customer
- Counterparty intelligence: Any known exchange, mixer, sanctioned entity, or high-risk jurisdiction exposure
If customer profile or expected activity is missing, note the gap explicitly — deviation from expected activity is a core detection signal and its absence limits certainty.
Instructions
Screen Activity Across 8 Red Flag Categories
For each red flag detected, record:
- The specific observed behavior (with amounts, dates, counterparties)
- Typology source: FATF Virtual Assets Red Flag Indicators (2020), FinCEN Advisory reference, or BSA structuring rule
- Severity: Low / Medium / High / Critical
- Corroboration needed: What additional data would confirm or clear the flag
Category 1 — Structuring & Threshold Avoidance Transactions patterned to evade reporting thresholds.
- Multiple transactions just below $10,000 (CTR) or $3,000 (recordkeeping) thresholds
- Cash or crypto deposits broken into rounds across days or accounts
- Deposits followed by rapid withdrawal at similar sub-threshold amounts
- FinCEN reference: 31 CFR 1010.314; FATF layering indicators
Category 2 — Rapid Movement & Velocity (Layering) Funds moving through accounts with no economic purpose.
- Pass-through activity: funds in and out within 24–72 hours, minimal residual balance
- High transaction velocity inconsistent with customer profile
- Chain-hopping across multiple virtual assets to obscure trail
- Peel chains: large amount split into many small hops to a destination
- FATF reference: VA Red Flag Indicators — transaction patterns
Category 3 — Obfuscation & Anonymity-Enhancing Tools Deliberate concealment of source, destination, or ownership.
- Use of mixers, tumblers, or coinjoin services
- Privacy coins (Monero, Zcash) in otherwise transparent-asset activity
- Transfers to/from unhosted wallets with no counterparty attribution
- Use of nested exchanges or unregistered VASPs
- FATF reference: obfuscation of source of funds indicators
Category 4 — Geographic & Jurisdictional Risk Exposure to high-risk or sanctioned geographies.
- Counterparties in FATF grey/black-list jurisdictions
- Activity involving OFAC-sanctioned regions or entities
- IP/geolocation mismatch with stated residence
- Funds routed through jurisdictions with no logical business nexus
- FinCEN reference: geographic risk advisories; OFAC sanctions lists
Category 5 — Profile & Behavioral Anomalies Activity inconsistent with the known customer.
- Volume or transaction size far exceeding expected activity per KYC
- Sudden account activation after dormancy
- Occupation/income inconsistent with transaction scale
- Reluctance to provide source-of-funds documentation
- Third-party control indicators (single device/IP across multiple accounts)
- FinCEN reference: unusual customer behavior advisories
Category 6 — Counterparty & Network Risk Suspicious relationships between accounts.
- Funnel accounts: many senders → one aggregator → single withdrawal
- Circular transaction flows returning funds to origin
- Interaction with wallets/accounts previously linked to fraud, ransomware, or darknet markets
- Newly created counterparties with immediate high-value activity
- FATF reference: transaction network typologies
Category 7 — Fraud, Scam & Illicit-Proceeds Indicators Signals of underlying predicate crime.
- Deposit patterns consistent with pig-butchering / romance scam victim flows
- Ransomware payment patterns (large one-time to known extortion clusters)
- Elder financial exploitation indicators
- Business email compromise (BEC) redirect patterns
- FinCEN reference: relevant fraud advisories and BEC alerts
Category 8 — Sanctions & Evasion Attempts to circumvent sanctions or embargoes.
- Transactions to/from OFAC SDN-linked addresses
- Value transfer patterns consistent with sanctions evasion (frequent small VA transfers to embargoed regions)
- Use of front entities or shell counterparties
- FinCEN reference: OFAC compliance advisories
After Screening: Consolidate the Findings
- Rank all flags by severity — Critical and High first.
- Identify typology clusters — where multiple flags reinforce a single scheme (e.g., structuring + velocity + funnel account = classic layering operation), state the composite typology explicitly.
- SAR-readiness assessment — for the overall pattern, assign one disposition: - File SAR — activity meets the "known or suspected" standard; state the two or three strongest supporting flags - Investigate further — indicators present but corroboration needed; list the specific data to pull - Clear/Monitor — flags explained by profile or documentation; note the rationale
- Draft the factual basis — 3–5 sentence neutral, chronological summary of the who/what/when/where/how much suitable for a SAR narrative. State facts only, no speculation or legal conclusions.
Output Format
- Structure: Findings grouped by category (only categories with hits shown), each flag with severity + typology citation; followed by consolidated ranking, typology cluster analysis, SAR-readiness disposition, and factual-basis draft
- Length: 700–1,100 words depending on flag count
- Format: Structured document — flag findings as labeled bullets, severity ranking as a table, factual basis as prose
- Sections: Detected Red Flags (by category) → Severity Ranking Table → Typology Cluster Analysis → SAR-Readiness Disposition → Factual Basis Draft
- Tone: Investigative and neutral — precise, evidence-anchored, no editorializing; the tone of an examination-ready workpaper
Quality Checklist
Before delivering output, verify:
- [ ] Every flagged behavior cites a specific FATF or FinCEN typology source — not a generic "suspicious" label
- [ ] Each flag has a severity rating (Low/Medium/High/Critical)
- [ ] The severity ranking table orders flags Critical → Low
- [ ] Typology cluster analysis names the composite scheme where flags reinforce each other
- [ ] SAR-readiness disposition is a single clear call (File / Investigate / Clear) with named supporting flags
- [ ] Factual basis draft contains only stated facts — no legal conclusions or speculation about guilt
Notes
- This skill supports, not replaces, human analyst judgment and institutional SAR-filing procedures — final filing decisions rest with the compliance team.
- The strongest cases are typology clusters, not single flags; one threshold-adjacent transaction rarely warrants a filing, but structuring + velocity + geographic risk together often do.
- When customer profile data is thin, deviation-from-expected-activity flags carry less weight — flag the KYC gap itself as a finding.
- Keep the factual basis strictly descriptive; SAR narratives are undermined by conclusory language like "the customer laundered funds."
How to use this skill
This file is a Claude Code skill in Anthropic's standard format — markdown with YAML frontmatter at the top.
Installing in Claude Code:
~/.claude/skills/<folder-name>/SKILL.md— auto-loads in every session anywhere on your machine (recommended for skills you'll use across multiple projects)<your-project>/.claude/skills/<folder-name>/SKILL.md— auto-loads only when working in that project (recommended for project-specific skills)
Restart Claude Code or open a new session to register.
Using in Claude.ai, ChatGPT, Gemini, or other AI tools:
- Drag this file into a new chat, or copy and paste its contents
- Send your task or request as your next message — the AI will apply the skill where it fits
For Claude Code skill details: https://docs.anthropic.com/en/docs/claude-code/skills